Arch Linux

for some reason the threshold parameter in -b has become mandatory, also the semantics of -l has changed. please consider the following changes:

remove -l- from sshguard-journalctl

rationale:
sshguard will parse stdin if no -l option is given. it will also not do excessive logging. this means you can remove this "patch"/hack:

sed -i 's|sshguard_log(LOG_INFO, "Refreshing sources showed|sshguard_log(LOG_DEBUG, "Refreshing sources showed|' src/sshguard_logsuck.c


change threshold for blacklisting to 120

rationale:
i think 120 was the previous default. while 40 blacklists the ip forever immediately 120 will block temporarily two times and blacklist on the third attack – each attack being 4 (?) failed logins.